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RECEIVED 
CENTRAL RAX CENTER 

IN THE CLAIMS FEB 1 5 2008 

Please AMEND THE CLAIMS as Follows: 

1. (original) A method of classifying a message, including: 

determining the domain from which the message is purported to be sent; 
determining an EP address from which the message was relayed at some point in 

its transmission; 
associating the domain with the IP address; and 

classifying the message based on the associated domain and IP address. 

2. (original) The method of claim 1, further including overriding a white list based on 
the classification. • 

3. (original) The method of claim 1, wherein classifying includes determining that the 
IP address is not commonly associated with the domain. 

4. (original) The method of claim 1, wherein classifying includes checking 
classifications of other messages associated with the same domain and different IP 
addresses. • , 

5. (original) The method of claim 1, wherein a plurality of EP addresses is associated 
with the domain. 

6. (original) The method of claim 1, wherein the IP address is associated with a 
plurality of domains. 

7. (original) The method of claim 1, wherein the IP address is a boundary IP address. 
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8. (original) The method of claim 1, wherein the IP address is preconfigured. 

9. (original) The method of claim 1, wherein the IP address is preconfigured to be one 
hop from a gateway IP address . 

10. (original) The method of claim 1, wherein the IP address is learned, 

11. (original) The method of claim 1, wherein the IP address is adaptively determined. 

12. (cancelled). 

13. (original) The method of claim 1, wherein the IP address is a boundary IP address 
determined according to claim 9. 

14. (original) The method of claim 1, wherein the domain is the stated sender domain. 

15. (original) The method of claim 1, wherein the domain is the boundary domain. 

16. (original) The method of claim 1, wherein classifying includes consulting a white 
list. 

17. (original) The method of claim 1, wherein classifying includes classifying the 
message based on previous classifications made to the IP address and domain pair, 

18. (original) The method of claim 1, wherein classifying includes forming a score 
based on previous classifications made to the IP address and domain pair. 

19. (original) The method of claim 1, wherein classifying includes determining a spam 
ratio. 
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20. (original) The method of claim 1, wherein classifying includes determining a spam 
rate. 

21. (original) The method of claim 1, wherein classifying includes determining an 
estimated instantaneous spam rate. 

22. (original) The method of claim 1, wherein classifying includes decaying a 
classification variable with time. 

23. (original) The method of claim 1, wherein classifying includes giving a 
classification greater weight relative to another classification. 

24. (original) The method of claim 1, wherein classifying includes giving a user 
classification greater weight relative to a computer classification. 

25. (original) The method of claim 1, wherein classifying includes giving an 
indeterminate classification a fraction of the weight of a good classification. 

26. (original) The method of claim 1, wherein classifying includes consulting a table 
indexed by IP address and domain. 

27. (original) The method of claim 1, wherein classifying includes consulting a table 
indexed by IP address and domain wherein each cell includes information about 
previous classifications. 

28. (original) The method of claim 1, further including providing the IP address and 
domain classification as input to another classifier. 
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29. (original) The method of claim 1, further including providing the IP address and 
domain classification as input to a Bayesiari classifier. 

30. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the IP address. 

31. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the domain. 

32. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the domain and determining that the message was forged. 

33. (original) The method of claim 1, wherein classifying includes determining a score 
for the IP address. 

34. (original) The method of claim 1, wherein classifying includes determining a score 
for the domain. 

35. (currently amended) A computer -readable storage medium having embodied 
thereon a program, th e program being executable by a processor to perform a method 
program product for classifying a message, the computer program product being - 
embodied in a computer readable medium and comprising computer instructions for 
comprising: 

determining the domain from which the message is purported to be sent; 
determining an IP address from which the message was relayed at some point in 

its transmission; 
associating the domain with the IP address; and 

classifying the message based on the associated domain and IP address. 
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36. (original) A system for classifying a message, including a classifier configured to: 
determine the domain from which the message is purported to be sent; 
determine an IP address from which the message was relayed at some point in 

its transmission; 
associate the domain with the IP address; and 

classify the message based on the associated domain and IP address. 
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